diff --git a/cmds/atrace/atrace.cpp b/cmds/atrace/atrace.cpp
index 099c3df..0d71bbd 100644
--- a/cmds/atrace/atrace.cpp
+++ b/cmds/atrace/atrace.cpp
@@ -84,6 +84,7 @@
     { "res",        "Resource Loading", ATRACE_TAG_RESOURCES, { } },
     { "dalvik",     "Dalvik VM",        ATRACE_TAG_DALVIK, { } },
     { "rs",         "RenderScript",     ATRACE_TAG_RS, { } },
+    { "bionic",     "Bionic C Library", ATRACE_TAG_BIONIC, { } },
     { "sched",      "CPU Scheduling",   0, {
         { REQ,      "/sys/kernel/debug/tracing/events/sched/sched_switch/enable" },
         { REQ,      "/sys/kernel/debug/tracing/events/sched/sched_wakeup/enable" },
diff --git a/cmds/flatland/Android.mk b/cmds/flatland/Android.mk
index d9478fe..c295167 100644
--- a/cmds/flatland/Android.mk
+++ b/cmds/flatland/Android.mk
@@ -13,7 +13,9 @@
 LOCAL_MODULE_TAGS := tests
 
 LOCAL_MODULE_PATH := $(local_target_dir)
-
+LOCAL_MULTILIB := both
+LOCAL_MODULE_STEM_32 := flatland
+LOCAL_MODULE_STEM_64 := flatland64
 LOCAL_SHARED_LIBRARIES := \
     libEGL      \
     libGLESv2   \
diff --git a/cmds/installd/commands.c b/cmds/installd/commands.c
index 886fd3b..8911570 100644
--- a/cmds/installd/commands.c
+++ b/cmds/installd/commands.c
@@ -265,27 +265,40 @@
     return 0;
 }
 
-int delete_user(userid_t userid)
+int create_user(userid_t userid)
 {
-    char data_path[PKG_PATH_MAX];
-    if (create_user_path(data_path, userid)) {
-        return -1;
-    }
-    if (delete_dir_contents(data_path, 1, NULL)) {
-        return -1;
-    }
-
-    char media_path[PATH_MAX];
-    if (create_user_media_path(media_path, userid) == -1) {
-        return -1;
-    }
-    if (delete_dir_contents(media_path, 1, NULL) == -1) {
+    if (ensure_config_user_dirs(userid) == -1) {
         return -1;
     }
 
     return 0;
 }
 
+int delete_user(userid_t userid)
+{
+    int status = 0;
+
+    char data_path[PKG_PATH_MAX];
+    if ((create_user_path(data_path, userid) != 0)
+            || (delete_dir_contents(data_path, 1, NULL) != 0)) {
+        status = -1;
+    }
+
+    char media_path[PATH_MAX];
+    if ((create_user_media_path(media_path, userid) != 0)
+            || (delete_dir_contents(media_path, 1, NULL) != 0)) {
+        status = -1;
+    }
+
+    char config_path[PATH_MAX];
+    if ((create_user_config_path(config_path, userid) != 0)
+            || (delete_dir_contents(config_path, 1, NULL) != 0)) {
+        status = -1;
+    }
+
+    return status;
+}
+
 int delete_cache(const char *pkgname, userid_t userid)
 {
     char cachedir[PKG_PATH_MAX];
@@ -612,6 +625,10 @@
     property_get("dalvik.vm.dex2oat-flags", dex2oat_flags, "");
     ALOGV("dalvik.vm.dex2oat-flags=%s\n", dex2oat_flags);
 
+    char profiler_prop[PROPERTY_VALUE_MAX];
+    bool profiler = property_get("dalvik.vm.profiler", profiler_prop, "0")
+                    && (profiler_prop[0] == '1');
+
     static const char* DEX2OAT_BIN = "/system/bin/dex2oat";
     static const int MAX_INT_LEN = 12;      // '-'+10dig+'\0' -OR- 0x+8dig
     static const unsigned int MAX_INSTRUCTION_SET_LEN = 32;
@@ -634,9 +651,17 @@
     sprintf(oat_fd_arg, "--oat-fd=%d", oat_fd);
     sprintf(oat_location_arg, "--oat-location=%s", output_file_name);
     sprintf(instruction_set_arg, "--instruction-set=%s", instruction_set);
-    if (strcmp(pkgname, "*") != 0) {
-        snprintf(profile_file_arg, sizeof(profile_file_arg), "--profile-file=%s/%s",
+
+    if (profiler && (strcmp(pkgname, "*") != 0)) {
+        char profile_file[PKG_PATH_MAX];
+        snprintf(profile_file, sizeof(profile_file), "%s/%s",
                  DALVIK_CACHE_PREFIX "profiles", pkgname);
+        struct stat st;
+        if (stat(profile_file, &st) == -1) {
+            strcpy(profile_file_arg, "--no-profile-file");
+        } else {
+            sprintf(profile_file_arg, "--profile-file=%s", profile_file);
+        }
     } else {
         strcpy(profile_file_arg, "--no-profile-file");
     }
diff --git a/cmds/installd/installd.c b/cmds/installd/installd.c
index 10bf5fa..f714836 100644
--- a/cmds/installd/installd.c
+++ b/cmds/installd/installd.c
@@ -109,6 +109,11 @@
                              /* pkgname, uid, userid, seinfo */
 }
 
+static int do_mk_user(char **arg, char reply[REPLY_MAX])
+{
+    return create_user(atoi(arg[0])); /* userid */
+}
+
 static int do_rm_user(char **arg, char reply[REPLY_MAX])
 {
     return delete_user(atoi(arg[0])); /* userid */
@@ -157,6 +162,7 @@
     { "movefiles",            0, do_movefiles },
     { "linklib",              3, do_linklib },
     { "mkuserdata",           4, do_mk_user_data },
+    { "mkuser",               1, do_mk_user },
     { "rmuser",               1, do_rm_user },
     { "idmap",                3, do_idmap },
     { "restorecondata",       3, do_restorecon_data },
@@ -483,6 +489,66 @@
         goto fail;
     }
 
+    if (ensure_config_user_dirs(0) == -1) {
+        ALOGE("Failed to setup misc for user 0");
+        goto fail;
+    }
+
+    if (version == 2) {
+        ALOGD("Upgrading to /data/misc/user directories");
+
+        DIR *dir;
+        struct dirent *dirent;
+        char user_data_dir[PATH_MAX];
+
+        dir = opendir(user_data_dir);
+        if (dir != NULL) {
+            while ((dirent = readdir(dir))) {
+                if (dirent->d_type == DT_DIR) {
+                    const char *name = dirent->d_name;
+
+                    // skip "." and ".."
+                    if (name[0] == '.') {
+                        if (name[1] == 0) continue;
+                        if ((name[1] == '.') && (name[2] == 0)) continue;
+                    }
+
+                    // /data/misc/user/<user_id>
+                    if (ensure_config_user_dirs(atoi(name)) == -1) {
+                        goto fail;
+                    }
+                }
+            }
+            closedir(dir);
+        }
+
+        // Just rename keychain files into user/0; they should already have the right permissions
+        char misc_dir[PATH_MAX];
+        char keychain_added_dir[PATH_MAX];
+        char keychain_removed_dir[PATH_MAX];
+        char config_added_dir[PATH_MAX];
+        char config_removed_dir[PATH_MAX];
+
+        snprintf(misc_dir, PATH_MAX, "%s/misc", android_data_dir.path);
+        snprintf(keychain_added_dir, PATH_MAX, "%s/keychain/cacerts-added", misc_dir);
+        snprintf(keychain_removed_dir, PATH_MAX, "%s/keychain/cacerts-removed", misc_dir);
+        snprintf(config_added_dir, PATH_MAX, "%s/user/0/cacerts-added", misc_dir);
+        snprintf(config_removed_dir, PATH_MAX, "%s/user/0/cacerts-removed", misc_dir);
+
+        if (access(keychain_added_dir, F_OK) == 0) {
+            if (rename(keychain_added_dir, config_added_dir) != 0) {
+                goto fail;
+            }
+        }
+        if (access(keychain_removed_dir, F_OK) == 0) {
+            if (rename(keychain_removed_dir, config_removed_dir) != 0) {
+                goto fail;
+            }
+        }
+
+        version = 3;
+    }
+
     // Persist layout version if changed
     if (version != oldVersion) {
         if (fs_write_atomic_int(version_path, version) == -1) {
diff --git a/cmds/installd/installd.h b/cmds/installd/installd.h
index 0f7119d..ff26e49 100644
--- a/cmds/installd/installd.h
+++ b/cmds/installd/installd.h
@@ -145,6 +145,8 @@
 
 int create_user_media_path(char path[PKG_PATH_MAX], userid_t userid);
 
+int create_user_config_path(char path[PKG_PATH_MAX], userid_t userid);
+
 int create_move_path(char path[PKG_PATH_MAX],
                      const char* pkgname,
                      const char* leaf,
@@ -190,6 +192,7 @@
 
 int ensure_dir(const char* path, mode_t mode, uid_t uid, gid_t gid);
 int ensure_media_user_dirs(userid_t userid);
+int ensure_config_user_dirs(userid_t userid);
 int create_profile_file(const char *pkgname, gid_t gid);
 void remove_profile_file(const char *pkgname);
 
@@ -201,6 +204,7 @@
 int fix_uid(const char *pkgname, uid_t uid, gid_t gid);
 int delete_user_data(const char *pkgname, userid_t userid);
 int make_user_data(const char *pkgname, uid_t uid, userid_t userid, const char* seinfo);
+int create_user(userid_t userid);
 int delete_user(userid_t userid);
 int delete_cache(const char *pkgname, userid_t userid);
 int move_dex(const char *src, const char *dst, const char *instruction_set);
diff --git a/cmds/installd/utils.c b/cmds/installd/utils.c
index 671d031..420ad5e 100644
--- a/cmds/installd/utils.c
+++ b/cmds/installd/utils.c
@@ -149,6 +149,17 @@
     return 0;
 }
 
+/**
+ * Create the path name for config for a certain userid.
+ * Returns 0 on success, and -1 on failure.
+ */
+int create_user_config_path(char path[PATH_MAX], userid_t userid) {
+    if (snprintf(path, PATH_MAX, "%s%d", "/data/misc/user/", userid) > PATH_MAX) {
+        return -1;
+    }
+    return 0;
+}
+
 int create_move_path(char path[PKG_PATH_MAX],
     const char* pkgname,
     const char* leaf,
@@ -1006,6 +1017,23 @@
     return 0;
 }
 
+int ensure_config_user_dirs(userid_t userid) {
+    char config_user_path[PATH_MAX];
+    char path[PATH_MAX];
+
+    // writable by system, readable by any app within the same user
+    const int uid = (userid * AID_USER) + AID_SYSTEM;
+    const int gid = (userid * AID_USER) + AID_EVERYBODY;
+
+    // Ensure /data/misc/user/<userid> exists
+    create_user_config_path(config_user_path, userid);
+    if (fs_prepare_dir(config_user_path, 0750, uid, gid) == -1) {
+        return -1;
+    }
+
+   return 0;
+}
+
 int create_profile_file(const char *pkgname, gid_t gid) {
     const char *profile_dir = DALVIK_CACHE_PREFIX "profiles";
     struct stat profileStat;
diff --git a/cmds/servicemanager/service_manager.c b/cmds/servicemanager/service_manager.c
index b5d52dd..3200012 100644
--- a/cmds/servicemanager/service_manager.c
+++ b/cmds/servicemanager/service_manager.c
@@ -32,6 +32,7 @@
     { AID_MEDIA, "media.player" },
     { AID_MEDIA, "media.camera" },
     { AID_MEDIA, "media.audio_policy" },
+    { AID_MEDIA, "media.sound_trigger_hw" },
     { AID_AUDIO, "audio" },
     { AID_INPUT, "input" },
     { AID_DRM,   "drm.drmManager" },
diff --git a/include/android/sensor.h b/include/android/sensor.h
index 64bc9b5..878f8ff 100644
--- a/include/android/sensor.h
+++ b/include/android/sensor.h
@@ -66,6 +66,7 @@
  * Sensor accuracy measure
  */
 enum {
+    ASENSOR_STATUS_NO_CONTACT       = -1,
     ASENSOR_STATUS_UNRELIABLE       = 0,
     ASENSOR_STATUS_ACCURACY_LOW     = 1,
     ASENSOR_STATUS_ACCURACY_MEDIUM  = 2,
@@ -130,6 +131,11 @@
   };
 } AUncalibratedEvent;
 
+typedef struct AHeartRateEvent {
+  float bpm;
+  int8_t status;
+} AHeartRateEvent;
+
 /* NOTE: Must match hardware/sensors.h */
 typedef struct ASensorEvent {
     int32_t version; /* sizeof(struct ASensorEvent) */
@@ -151,6 +157,7 @@
             AUncalibratedEvent uncalibrated_gyro;
             AUncalibratedEvent uncalibrated_magnetic;
             AMetaDataEvent meta_data;
+            AHeartRateEvent heart_rate;
         };
         union {
             uint64_t        data[8];
diff --git a/include/gui/ISurfaceComposer.h b/include/gui/ISurfaceComposer.h
index 8042211..1581084 100644
--- a/include/gui/ISurfaceComposer.h
+++ b/include/gui/ISurfaceComposer.h
@@ -41,6 +41,7 @@
 class DisplayInfo;
 class IDisplayEventConnection;
 class IMemoryHeap;
+class Rect;
 
 /*
  * This class defines the Binder IPC interface for accessing various
@@ -131,11 +132,10 @@
      */
     virtual status_t captureScreen(const sp<IBinder>& display,
             const sp<IGraphicBufferProducer>& producer,
-            uint32_t reqWidth, uint32_t reqHeight,
+            Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
             uint32_t minLayerZ, uint32_t maxLayerZ,
             bool useIdentityTransform) = 0;
 
-
     /* Clears the frame statistics for animations.
      *
      * Requires the ACCESS_SURFACE_FLINGER permission.
diff --git a/include/gui/Sensor.h b/include/gui/Sensor.h
index 41a6cc6..c1c98b9 100644
--- a/include/gui/Sensor.h
+++ b/include/gui/Sensor.h
@@ -71,6 +71,7 @@
     int32_t getFifoMaxEventCount() const;
     const String8& getStringType() const;
     const String8& getRequiredPermission() const;
+    int32_t getMaxDelay() const;
     bool isWakeUpSensor() const;
 
     // LightFlattenable protocol
@@ -94,7 +95,7 @@
     int32_t mFifoMaxEventCount;
     String8 mStringType;
     String8 mRequiredPermission;
-    // Todo: Surface this in java SDK.
+    int32_t mMaxDelay;
     bool    mWakeUpSensor;
     static void flattenString8(void*& buffer, size_t& size, const String8& string8);
     static bool unflattenString8(void const*& buffer, size_t& size, String8& outputString8);
diff --git a/include/gui/SurfaceComposerClient.h b/include/gui/SurfaceComposerClient.h
index c2192af..e666329 100644
--- a/include/gui/SurfaceComposerClient.h
+++ b/include/gui/SurfaceComposerClient.h
@@ -180,10 +180,12 @@
 class ScreenshotClient
 {
 public:
+    // if cropping isn't required, callers may pass in a default Rect, e.g.:
+    //   capture(display, producer, Rect(), reqWidth, ...);
     static status_t capture(
             const sp<IBinder>& display,
             const sp<IGraphicBufferProducer>& producer,
-            uint32_t reqWidth, uint32_t reqHeight,
+            Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
             uint32_t minLayerZ, uint32_t maxLayerZ,
             bool useIdentityTransform);
 
@@ -197,13 +199,16 @@
     ScreenshotClient();
     ~ScreenshotClient();
 
-    // frees the previous screenshot and capture a new one
-    status_t update(const sp<IBinder>& display, bool useIdentityTransform);
+    // frees the previous screenshot and captures a new one
+    // if cropping isn't required, callers may pass in a default Rect, e.g.:
+    //   update(display, Rect(), useIdentityTransform);
     status_t update(const sp<IBinder>& display,
-            uint32_t reqWidth, uint32_t reqHeight,
+            Rect sourceCrop, bool useIdentityTransform);
+    status_t update(const sp<IBinder>& display,
+            Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
             bool useIdentityTransform);
     status_t update(const sp<IBinder>& display,
-            uint32_t reqWidth, uint32_t reqHeight,
+            Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
             uint32_t minLayerZ, uint32_t maxLayerZ,
             bool useIdentityTransform);
 
diff --git a/include/input/Input.h b/include/input/Input.h
index a4fa317..bba8f1e 100644
--- a/include/input/Input.h
+++ b/include/input/Input.h
@@ -189,7 +189,7 @@
     enum { MAX_AXES = 14 }; // 14 so that sizeof(PointerCoords) == 64
 
     // Bitfield of axes that are present in this structure.
-    uint64_t bits;
+    uint64_t bits __attribute__((aligned(8)));
 
     // Values of axes that are stored in this structure packed in order by axis id
     // for each axis that is present in the structure according to 'bits'.
diff --git a/include/input/InputTransport.h b/include/input/InputTransport.h
index 8ffdfca..e7e383b 100644
--- a/include/input/InputTransport.h
+++ b/include/input/InputTransport.h
@@ -39,6 +39,9 @@
 
 /*
  * Intermediate representation used to send input events and related signals.
+ *
+ * Note that this structure is used for IPCs so its layout must be identical
+ * on 64 and 32 bit processes. This is tested in StructLayout_test.cpp.
  */
 struct InputMessage {
     enum {
@@ -49,13 +52,17 @@
 
     struct Header {
         uint32_t type;
-        uint32_t padding; // 8 byte alignment for the body that follows
+        // We don't need this field in order to align the body below but we
+        // leave it here because InputMessage::size() and other functions
+        // compute the size of this structure as sizeof(Header) + sizeof(Body).
+        uint32_t padding;
     } header;
 
+    // Body *must* be 8 byte aligned.
     union Body {
         struct Key {
             uint32_t seq;
-            nsecs_t eventTime;
+            nsecs_t eventTime __attribute__((aligned(8)));
             int32_t deviceId;
             int32_t source;
             int32_t action;
@@ -64,7 +71,7 @@
             int32_t scanCode;
             int32_t metaState;
             int32_t repeatCount;
-            nsecs_t downTime;
+            nsecs_t downTime __attribute__((aligned(8)));
 
             inline size_t size() const {
                 return sizeof(Key);
@@ -73,7 +80,7 @@
 
         struct Motion {
             uint32_t seq;
-            nsecs_t eventTime;
+            nsecs_t eventTime __attribute__((aligned(8)));
             int32_t deviceId;
             int32_t source;
             int32_t action;
@@ -81,13 +88,14 @@
             int32_t metaState;
             int32_t buttonState;
             int32_t edgeFlags;
-            nsecs_t downTime;
+            nsecs_t downTime __attribute__((aligned(8)));
             float xOffset;
             float yOffset;
             float xPrecision;
             float yPrecision;
             uint32_t pointerCount;
-            struct Pointer {
+            // Note that PointerCoords requires 8 byte alignment.
+            struct Pointer{
                 PointerProperties properties;
                 PointerCoords coords;
             } pointers[MAX_POINTERS];
@@ -112,7 +120,7 @@
                 return sizeof(Finished);
             }
         } finished;
-    } body;
+    } __attribute__((aligned(8))) body;
 
     bool isValid(size_t actualSize) const;
     size_t size() const;
diff --git a/libs/binder/Android.mk b/libs/binder/Android.mk
index c8a1e35..79decfe 100644
--- a/libs/binder/Android.mk
+++ b/libs/binder/Android.mk
@@ -47,6 +47,7 @@
 LOCAL_CFLAGS += -DBINDER_IPC_32BIT=1
 endif
 endif
+LOCAL_CFLAGS += -Werror
 include $(BUILD_SHARED_LIBRARY)
 
 include $(CLEAR_VARS)
@@ -58,4 +59,5 @@
 LOCAL_CFLAGS += -DBINDER_IPC_32BIT=1
 endif
 endif
+LOCAL_CFLAGS += -Werror
 include $(BUILD_STATIC_LIBRARY)
diff --git a/libs/binder/BpBinder.cpp b/libs/binder/BpBinder.cpp
index 1bad67a..101de7e 100644
--- a/libs/binder/BpBinder.cpp
+++ b/libs/binder/BpBinder.cpp
@@ -73,7 +73,7 @@
 void BpBinder::ObjectManager::kill()
 {
     const size_t N = mObjects.size();
-    ALOGV("Killing %d objects in manager %p", N, this);
+    ALOGV("Killing %zu objects in manager %p", N, this);
     for (size_t i=0; i<N; i++) {
         const entry_t& e = mObjects.valueAt(i);
         if (e.func != NULL) {
@@ -119,11 +119,11 @@
                 mDescriptorCache = res;
         }
     }
-    
+
     // we're returning a reference to a non-static object here. Usually this
-    // is not something smart to do, however, with binder objects it is 
+    // is not something smart to do, however, with binder objects it is
     // (usually) safe because they are reference-counted.
-    
+
     return mDescriptorCache;
 }
 
@@ -260,8 +260,8 @@
     mObitsSent = 1;
     mLock.unlock();
 
-    ALOGV("Reporting death of proxy %p for %d recipients\n",
-        this, obits ? obits->size() : 0);
+    ALOGV("Reporting death of proxy %p for %zu recipients\n",
+        this, obits ? obits->size() : 0U);
 
     if (obits != NULL) {
         const size_t N = obits->size();
diff --git a/libs/binder/IAppOpsCallback.cpp b/libs/binder/IAppOpsCallback.cpp
index e0aad23..2aaf566 100644
--- a/libs/binder/IAppOpsCallback.cpp
+++ b/libs/binder/IAppOpsCallback.cpp
@@ -18,7 +18,6 @@
 
 #include <binder/IAppOpsCallback.h>
 
-#include <utils/Debug.h>
 #include <utils/Log.h>
 #include <binder/Parcel.h>
 #include <utils/String8.h>
diff --git a/libs/binder/IAppOpsService.cpp b/libs/binder/IAppOpsService.cpp
index 471e3e9..f58a352 100644
--- a/libs/binder/IAppOpsService.cpp
+++ b/libs/binder/IAppOpsService.cpp
@@ -18,7 +18,6 @@
 
 #include <binder/IAppOpsService.h>
 
-#include <utils/Debug.h>
 #include <utils/Log.h>
 #include <binder/Parcel.h>
 #include <utils/String8.h>
diff --git a/libs/binder/IBatteryStats.cpp b/libs/binder/IBatteryStats.cpp
index 6469b08..5702151 100644
--- a/libs/binder/IBatteryStats.cpp
+++ b/libs/binder/IBatteryStats.cpp
@@ -16,7 +16,6 @@
 
 #include <binder/IBatteryStats.h>
 
-#include <utils/Debug.h>
 #include <utils/Log.h>
 #include <binder/Parcel.h>
 #include <utils/String8.h>
diff --git a/libs/binder/IPCThreadState.cpp b/libs/binder/IPCThreadState.cpp
index 35dba12..57c4638 100644
--- a/libs/binder/IPCThreadState.cpp
+++ b/libs/binder/IPCThreadState.cpp
@@ -23,7 +23,6 @@
 #include <binder/TextOutput.h>
 
 #include <cutils/sched_policy.h>
-#include <utils/Debug.h>
 #include <utils/Log.h>
 #include <utils/threads.h>
 
diff --git a/libs/binder/IPermissionController.cpp b/libs/binder/IPermissionController.cpp
index e13036f..437113d 100644
--- a/libs/binder/IPermissionController.cpp
+++ b/libs/binder/IPermissionController.cpp
@@ -18,7 +18,6 @@
 
 #include <binder/IPermissionController.h>
 
-#include <utils/Debug.h>
 #include <utils/Log.h>
 #include <binder/Parcel.h>
 #include <utils/String8.h>
diff --git a/libs/binder/IServiceManager.cpp b/libs/binder/IServiceManager.cpp
index a341ca8..7b1b0e7 100644
--- a/libs/binder/IServiceManager.cpp
+++ b/libs/binder/IServiceManager.cpp
@@ -18,7 +18,6 @@
 
 #include <binder/IServiceManager.h>
 
-#include <utils/Debug.h>
 #include <utils/Log.h>
 #include <binder/IPCThreadState.h>
 #include <binder/Parcel.h>
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 52fff82..f0d8732 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -155,7 +155,7 @@
     const sp<IBinder>& binder, Parcel* out)
 {
     flat_binder_object obj;
-    
+
     obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
     if (binder != NULL) {
         IBinder *local = binder->localBinder();
@@ -179,7 +179,7 @@
         obj.binder = 0;
         obj.cookie = 0;
     }
-    
+
     return finish_flatten_binder(binder, obj, out);
 }
 
@@ -187,7 +187,7 @@
     const wp<IBinder>& binder, Parcel* out)
 {
     flat_binder_object obj;
-    
+
     obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
     if (binder != NULL) {
         sp<IBinder> real = binder.promote();
@@ -210,7 +210,7 @@
             }
             return finish_flatten_binder(real, obj, out);
         }
-        
+
         // XXX How to deal?  In order to flatten the given binder,
         // we need to probe it for information, which requires a primary
         // reference...  but we don't have one.
@@ -223,7 +223,7 @@
         obj.binder = 0;
         obj.cookie = 0;
         return finish_flatten_binder(NULL, obj, out);
-    
+
     } else {
         obj.type = BINDER_TYPE_BINDER;
         obj.binder = 0;
@@ -238,12 +238,12 @@
 {
     return NO_ERROR;
 }
-    
+
 status_t unflatten_binder(const sp<ProcessState>& proc,
     const Parcel& in, sp<IBinder>* out)
 {
     const flat_binder_object* flat = in.readObject(false);
-    
+
     if (flat) {
         switch (flat->type) {
             case BINDER_TYPE_BINDER:
@@ -253,7 +253,7 @@
                 *out = proc->getStrongProxyForHandle(flat->handle);
                 return finish_unflatten_binder(
                     static_cast<BpBinder*>(out->get()), *flat, in);
-        }        
+        }
     }
     return BAD_TYPE;
 }
@@ -262,7 +262,7 @@
     const Parcel& in, wp<IBinder>* out)
 {
     const flat_binder_object* flat = in.readObject(false);
-    
+
     if (flat) {
         switch (flat->type) {
             case BINDER_TYPE_BINDER:
@@ -336,7 +336,7 @@
     err = continueWrite(size);
     if (err == NO_ERROR) {
         mDataSize = size;
-        ALOGV("setDataSize Setting data size of %p to %d\n", this, mDataSize);
+        ALOGV("setDataSize Setting data size of %p to %zu", this, mDataSize);
     }
     return err;
 }
@@ -424,7 +424,7 @@
             mObjects = objects;
             mObjectsCapacity = newSize;
         }
-        
+
         // append and acquire objects
         int idx = mObjectsSize;
         for (int i = firstIndex; i <= lastIndex; i++) {
@@ -510,7 +510,7 @@
     if (str == interface) {
         return true;
     } else {
-        ALOGW("**** enforceInterface() expected '%s' but read '%s'\n",
+        ALOGW("**** enforceInterface() expected '%s' but read '%s'",
                 String8(interface).string(), String8(str).string());
         return false;
     }
@@ -540,10 +540,10 @@
 {
     //printf("Finish write of %d\n", len);
     mDataPos += len;
-    ALOGV("finishWrite Setting data pos of %p to %d\n", this, mDataPos);
+    ALOGV("finishWrite Setting data pos of %p to %zu", this, mDataPos);
     if (mDataPos > mDataSize) {
         mDataSize = mDataPos;
-        ALOGV("finishWrite Setting data size of %p to %d\n", this, mDataSize);
+        ALOGV("finishWrite Setting data size of %p to %zu", this, mDataSize);
     }
     //printf("New pos=%d, size=%d\n", mDataPos, mDataSize);
     return NO_ERROR;
@@ -709,7 +709,7 @@
 status_t Parcel::writeString16(const char16_t* str, size_t len)
 {
     if (str == NULL) return writeInt32(-1);
-    
+
     status_t err = writeInt32(len);
     if (err == NO_ERROR) {
         len *= sizeof(char16_t);
@@ -898,14 +898,14 @@
     if (enoughData && enoughObjects) {
 restart_write:
         *reinterpret_cast<flat_binder_object*>(mData+mDataPos) = val;
-        
+
         // Need to write meta-data?
         if (nullMetaData || val.binder != 0) {
             mObjects[mObjectsSize] = mDataPos;
             acquire_object(ProcessState::self(), val, this);
             mObjectsSize++;
         }
-        
+
         // remember if it's a file descriptor
         if (val.type == BINDER_TYPE_FD) {
             if (!mAllowFds) {
@@ -928,7 +928,7 @@
         mObjects = objects;
         mObjectsCapacity = newSize;
     }
-    
+
     goto restart_write;
 }
 
@@ -948,7 +948,7 @@
             && len <= PAD_SIZE(len)) {
         memcpy(outData, mData+mDataPos, len);
         mDataPos += PAD_SIZE(len);
-        ALOGV("read Setting data pos of %p to %d\n", this, mDataPos);
+        ALOGV("read Setting data pos of %p to %zu", this, mDataPos);
         return NO_ERROR;
     }
     return NOT_ENOUGH_DATA;
@@ -960,7 +960,7 @@
             && len <= PAD_SIZE(len)) {
         const void* data = mData+mDataPos;
         mDataPos += PAD_SIZE(len);
-        ALOGV("readInplace Setting data pos of %p to %d\n", this, mDataPos);
+        ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);
         return data;
     }
     return NULL;
@@ -1062,6 +1062,7 @@
       double d;
       unsigned long long ll;
     } u;
+    u.d = 0;
     status_t status;
     status = readAligned(&u.ll);
     *pArg = u.d;
@@ -1114,7 +1115,7 @@
         if (eos) {
             const size_t len = eos - str;
             mDataPos += PAD_SIZE(len+1);
-            ALOGV("readCString Setting data pos of %p to %d\n", this, mDataPos);
+            ALOGV("readCString Setting data pos of %p to %zu", this, mDataPos);
             return str;
         }
     }
@@ -1216,9 +1217,9 @@
     if (flat) {
         switch (flat->type) {
             case BINDER_TYPE_FD:
-                //ALOGI("Returning file descriptor %ld from parcel %p\n", flat->handle, this);
+                //ALOGI("Returning file descriptor %ld from parcel %p", flat->handle, this);
                 return flat->handle;
-        }        
+        }
     }
     return BAD_TYPE;
 }
@@ -1287,7 +1288,7 @@
         fds[i] = dup(this->readFileDescriptor());
         if (fds[i] < 0) {
             err = BAD_VALUE;
-            ALOGE("dup() failed in Parcel::read, i is %d, fds[i] is %d, fd_count is %d, error: %s",
+            ALOGE("dup() failed in Parcel::read, i is %zu, fds[i] is %d, fd_count is %zu, error: %s",
                 i, fds[i], fd_count, strerror(errno));
         }
     }
@@ -1313,19 +1314,19 @@
             // When transferring a NULL object, we don't write it into
             // the object list, so we don't want to check for it when
             // reading.
-            ALOGV("readObject Setting data pos of %p to %d\n", this, mDataPos);
+            ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
             return obj;
         }
-        
+
         // Ensure that this object is valid...
         binder_size_t* const OBJS = mObjects;
         const size_t N = mObjectsSize;
         size_t opos = mNextObjectHint;
-        
+
         if (N > 0) {
-            ALOGV("Parcel %p looking for obj at %d, hint=%d\n",
+            ALOGV("Parcel %p looking for obj at %zu, hint=%zu",
                  this, DPOS, opos);
-            
+
             // Start at the current hint position, looking for an object at
             // the current data position.
             if (opos < N) {
@@ -1337,23 +1338,23 @@
             }
             if (OBJS[opos] == DPOS) {
                 // Found it!
-                ALOGV("Parcel found obj %d at index %d with forward search",
+                ALOGV("Parcel %p found obj %zu at index %zu with forward search",
                      this, DPOS, opos);
                 mNextObjectHint = opos+1;
-                ALOGV("readObject Setting data pos of %p to %d\n", this, mDataPos);
+                ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
                 return obj;
             }
-        
+
             // Look backwards for it...
             while (opos > 0 && OBJS[opos] > DPOS) {
                 opos--;
             }
             if (OBJS[opos] == DPOS) {
                 // Found it!
-                ALOGV("Parcel found obj %d at index %d with backward search",
+                ALOGV("Parcel %p found obj %zu at index %zu with backward search",
                      this, DPOS, opos);
                 mNextObjectHint = opos+1;
-                ALOGV("readObject Setting data pos of %p to %d\n", this, mDataPos);
+                ALOGV("readObject Setting data pos of %p to %zu", this, mDataPos);
                 return obj;
             }
         }
@@ -1367,14 +1368,14 @@
 {
     size_t i = mObjectsSize;
     if (i > 0) {
-        //ALOGI("Closing file descriptors for %d objects...", mObjectsSize);
+        //ALOGI("Closing file descriptors for %zu objects...", i);
     }
     while (i > 0) {
         i--;
         const flat_binder_object* flat
             = reinterpret_cast<flat_binder_object*>(mData+mObjects[i]);
         if (flat->type == BINDER_TYPE_FD) {
-            //ALOGI("Closing fd: %ld\n", flat->handle);
+            //ALOGI("Closing fd: %ld", flat->handle);
             close(flat->handle);
         }
     }
@@ -1408,9 +1409,9 @@
     mError = NO_ERROR;
     mData = const_cast<uint8_t*>(data);
     mDataSize = mDataCapacity = dataSize;
-    //ALOGI("setDataReference Setting data size of %p to %lu (pid=%d)\n", this, mDataSize, getpid());
+    //ALOGI("setDataReference Setting data size of %p to %lu (pid=%d)", this, mDataSize, getpid());
     mDataPos = 0;
-    ALOGV("setDataReference Setting data pos of %p to %d\n", this, mDataPos);
+    ALOGV("setDataReference Setting data pos of %p to %zu", this, mDataPos);
     mObjects = const_cast<binder_size_t*>(objects);
     mObjectsSize = mObjectsCapacity = objectsCount;
     mNextObjectHint = 0;
@@ -1432,7 +1433,7 @@
 void Parcel::print(TextOutput& to, uint32_t /*flags*/) const
 {
     to << "Parcel(";
-    
+
     if (errorCheck() != NO_ERROR) {
         const status_t err = errorCheck();
         to << "Error: " << (void*)(intptr_t)err << " \"" << strerror(-err) << "\"";
@@ -1451,7 +1452,7 @@
     } else {
         to << "NULL";
     }
-    
+
     to << ")";
 }
 
@@ -1492,7 +1493,7 @@
 void Parcel::freeDataNoInit()
 {
     if (mOwner) {
-        //ALOGI("Freeing data ref of %p (pid=%d)\n", this, getpid());
+        //ALOGI("Freeing data ref of %p (pid=%d)", this, getpid());
         mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
     } else {
         releaseObjects();
@@ -1515,24 +1516,24 @@
         freeData();
         return continueWrite(desired);
     }
-    
+
     uint8_t* data = (uint8_t*)realloc(mData, desired);
     if (!data && desired > mDataCapacity) {
         mError = NO_MEMORY;
         return NO_MEMORY;
     }
-    
+
     releaseObjects();
-    
+
     if (data) {
         mData = data;
         mDataCapacity = desired;
     }
-    
+
     mDataSize = mDataPos = 0;
-    ALOGV("restartWrite Setting data size of %p to %d\n", this, mDataSize);
-    ALOGV("restartWrite Setting data pos of %p to %d\n", this, mDataPos);
-        
+    ALOGV("restartWrite Setting data size of %p to %zu", this, mDataSize);
+    ALOGV("restartWrite Setting data pos of %p to %zu", this, mDataPos);
+
     free(mObjects);
     mObjects = NULL;
     mObjectsSize = mObjectsCapacity = 0;
@@ -1540,7 +1541,7 @@
     mHasFds = false;
     mFdsKnown = true;
     mAllowFds = true;
-    
+
     return NO_ERROR;
 }
 
@@ -1560,7 +1561,7 @@
             }
         }
     }
-    
+
     if (mOwner) {
         // If the size is going to zero, just release the owner's data.
         if (desired == 0) {
@@ -1576,7 +1577,7 @@
             return NO_MEMORY;
         }
         binder_size_t* objects = NULL;
-        
+
         if (objectsSize) {
             objects = (binder_size_t*)malloc(objectsSize*sizeof(binder_size_t));
             if (!objects) {
@@ -1593,21 +1594,21 @@
             acquireObjects();
             mObjectsSize = oldObjectsSize;
         }
-        
+
         if (mData) {
             memcpy(data, mData, mDataSize < desired ? mDataSize : desired);
         }
         if (objects && mObjects) {
             memcpy(objects, mObjects, objectsSize*sizeof(binder_size_t));
         }
-        //ALOGI("Freeing data ref of %p (pid=%d)\n", this, getpid());
+        //ALOGI("Freeing data ref of %p (pid=%d)", this, getpid());
         mOwner(this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);
         mOwner = NULL;
 
         mData = data;
         mObjects = objects;
         mDataSize = (mDataSize < desired) ? mDataSize : desired;
-        ALOGV("continueWrite Setting data size of %p to %d\n", this, mDataSize);
+        ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
         mDataCapacity = desired;
         mObjectsSize = mObjectsCapacity = objectsSize;
         mNextObjectHint = 0;
@@ -1647,14 +1648,14 @@
         } else {
             if (mDataSize > desired) {
                 mDataSize = desired;
-                ALOGV("continueWrite Setting data size of %p to %d\n", this, mDataSize);
+                ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
             }
             if (mDataPos > desired) {
                 mDataPos = desired;
-                ALOGV("continueWrite Setting data pos of %p to %d\n", this, mDataPos);
+                ALOGV("continueWrite Setting data pos of %p to %zu", this, mDataPos);
             }
         }
-        
+
     } else {
         // This is the first data.  Easy!
         uint8_t* data = (uint8_t*)malloc(desired);
@@ -1667,11 +1668,11 @@
              && mObjectsCapacity == 0)) {
             ALOGE("continueWrite: %zu/%p/%zu/%zu", mDataCapacity, mObjects, mObjectsCapacity, desired);
         }
-        
+
         mData = data;
         mDataSize = mDataPos = 0;
-        ALOGV("continueWrite Setting data size of %p to %d\n", this, mDataSize);
-        ALOGV("continueWrite Setting data pos of %p to %d\n", this, mDataPos);
+        ALOGV("continueWrite Setting data size of %p to %zu", this, mDataSize);
+        ALOGV("continueWrite Setting data pos of %p to %zu", this, mDataPos);
         mDataCapacity = desired;
     }
 
@@ -1685,8 +1686,8 @@
     mDataSize = 0;
     mDataCapacity = 0;
     mDataPos = 0;
-    ALOGV("initState Setting data size of %p to %d\n", this, mDataSize);
-    ALOGV("initState Setting data pos of %p to %d\n", this, mDataPos);
+    ALOGV("initState Setting data size of %p to %zu", this, mDataSize);
+    ALOGV("initState Setting data pos of %p to %zu", this, mDataPos);
     mObjects = NULL;
     mObjectsSize = 0;
     mObjectsCapacity = 0;
diff --git a/libs/gui/ISurfaceComposer.cpp b/libs/gui/ISurfaceComposer.cpp
index 58a2ae2..c6c88a9 100644
--- a/libs/gui/ISurfaceComposer.cpp
+++ b/libs/gui/ISurfaceComposer.cpp
@@ -104,7 +104,7 @@
 
     virtual status_t captureScreen(const sp<IBinder>& display,
             const sp<IGraphicBufferProducer>& producer,
-            uint32_t reqWidth, uint32_t reqHeight,
+            Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
             uint32_t minLayerZ, uint32_t maxLayerZ,
             bool useIdentityTransform)
     {
@@ -112,6 +112,7 @@
         data.writeInterfaceToken(ISurfaceComposer::getInterfaceDescriptor());
         data.writeStrongBinder(display);
         data.writeStrongBinder(producer->asBinder());
+        data.write(sourceCrop);
         data.writeInt32(reqWidth);
         data.writeInt32(reqHeight);
         data.writeInt32(minLayerZ);
@@ -328,6 +329,8 @@
             sp<IBinder> display = data.readStrongBinder();
             sp<IGraphicBufferProducer> producer =
                     interface_cast<IGraphicBufferProducer>(data.readStrongBinder());
+            Rect sourceCrop;
+            data.read(sourceCrop);
             uint32_t reqWidth = data.readInt32();
             uint32_t reqHeight = data.readInt32();
             uint32_t minLayerZ = data.readInt32();
@@ -335,7 +338,7 @@
             bool useIdentityTransform = static_cast<bool>(data.readInt32());
 
             status_t res = captureScreen(display, producer,
-                    reqWidth, reqHeight, minLayerZ, maxLayerZ,
+                    sourceCrop, reqWidth, reqHeight, minLayerZ, maxLayerZ,
                     useIdentityTransform);
             reply->writeInt32(res);
             return NO_ERROR;
diff --git a/libs/gui/Sensor.cpp b/libs/gui/Sensor.cpp
index 6d12225..70180f8 100644
--- a/libs/gui/Sensor.cpp
+++ b/libs/gui/Sensor.cpp
@@ -16,6 +16,7 @@
 
 #include <stdint.h>
 #include <sys/types.h>
+#include <sys/limits.h>
 
 #include <utils/Errors.h>
 #include <utils/String8.h>
@@ -24,6 +25,7 @@
 #include <hardware/sensors.h>
 
 #include <gui/Sensor.h>
+#include <log/log.h>
 
 // ----------------------------------------------------------------------------
 namespace android {
@@ -33,7 +35,7 @@
     : mHandle(0), mType(0),
       mMinValue(0), mMaxValue(0), mResolution(0),
       mPower(0), mMinDelay(0), mFifoReservedEventCount(0), mFifoMaxEventCount(0),
-      mWakeUpSensor(false)
+      mMaxDelay(0), mWakeUpSensor(false)
 {
 }
 
@@ -61,6 +63,20 @@
         mFifoMaxEventCount = 0;
     }
 
+    if (halVersion >= SENSORS_DEVICE_API_VERSION_1_3) {
+        if (hwSensor->maxDelay > INT_MAX) {
+            // Max delay is declared as a 64 bit integer for 64 bit architectures. But it should
+            // always fit in a 32 bit integer, log error and cap it to INT_MAX.
+            ALOGE("Sensor maxDelay overflow error %s %lld", mName.string(), hwSensor->maxDelay);
+            mMaxDelay = INT_MAX;
+        } else {
+            mMaxDelay = (int32_t) hwSensor->maxDelay;
+        }
+    } else {
+        // For older hals set maxDelay to 0.
+        mMaxDelay = 0;
+    }
+
     // Ensure existing sensors have correct string type and required
     // permissions.
     switch (mType) {
@@ -289,6 +305,10 @@
     return mRequiredPermission;
 }
 
+int32_t Sensor::getMaxDelay() const {
+    return mMaxDelay;
+}
+
 bool Sensor::isWakeUpSensor() const {
     return mWakeUpSensor;
 }
@@ -298,7 +318,8 @@
     size_t fixedSize =
             sizeof(int32_t) * 3 +
             sizeof(float) * 4 +
-            sizeof(int32_t) * 3;
+            sizeof(int32_t) * 4 +
+            sizeof(bool) * 1;
 
     size_t variableSize =
             sizeof(uint32_t) + FlattenableUtils::align<4>(mName.length()) +
@@ -328,6 +349,8 @@
     FlattenableUtils::write(buffer, size, mFifoMaxEventCount);
     flattenString8(buffer, size, mStringType);
     flattenString8(buffer, size, mRequiredPermission);
+    FlattenableUtils::write(buffer, size, mMaxDelay);
+    FlattenableUtils::write(buffer, size, mWakeUpSensor);
     return NO_ERROR;
 }
 
@@ -342,7 +365,8 @@
     size_t fixedSize =
             sizeof(int32_t) * 3 +
             sizeof(float) * 4 +
-            sizeof(int32_t) * 3;
+            sizeof(int32_t) * 4 +
+            sizeof(bool) * 1;
     if (size < fixedSize) {
         return NO_MEMORY;
     }
@@ -364,6 +388,8 @@
     if (!unflattenString8(buffer, size, mRequiredPermission)) {
         return NO_MEMORY;
     }
+    FlattenableUtils::read(buffer, size, mMaxDelay);
+    FlattenableUtils::read(buffer, size, mWakeUpSensor);
     return NO_ERROR;
 }
 
diff --git a/libs/gui/SurfaceComposerClient.cpp b/libs/gui/SurfaceComposerClient.cpp
index 1dffdb2..eedeca1 100644
--- a/libs/gui/SurfaceComposerClient.cpp
+++ b/libs/gui/SurfaceComposerClient.cpp
@@ -676,11 +676,11 @@
 status_t ScreenshotClient::capture(
         const sp<IBinder>& display,
         const sp<IGraphicBufferProducer>& producer,
-        uint32_t reqWidth, uint32_t reqHeight,
+        Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
         uint32_t minLayerZ, uint32_t maxLayerZ, bool useIdentityTransform) {
     sp<ISurfaceComposer> s(ComposerService::getComposerService());
     if (s == NULL) return NO_INIT;
-    return s->captureScreen(display, producer,
+    return s->captureScreen(display, producer, sourceCrop,
             reqWidth, reqHeight, minLayerZ, maxLayerZ, useIdentityTransform);
 }
 
@@ -704,7 +704,7 @@
 }
 
 status_t ScreenshotClient::update(const sp<IBinder>& display,
-        uint32_t reqWidth, uint32_t reqHeight,
+        Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
         uint32_t minLayerZ, uint32_t maxLayerZ,
         bool useIdentityTransform) {
     sp<ISurfaceComposer> s(ComposerService::getComposerService());
@@ -717,7 +717,7 @@
         mHaveBuffer = false;
     }
 
-    status_t err = s->captureScreen(display, mProducer,
+    status_t err = s->captureScreen(display, mProducer, sourceCrop,
             reqWidth, reqHeight, minLayerZ, maxLayerZ, useIdentityTransform);
 
     if (err == NO_ERROR) {
@@ -729,16 +729,16 @@
     return err;
 }
 
-status_t ScreenshotClient::update(const sp<IBinder>& display,
+status_t ScreenshotClient::update(const sp<IBinder>& display, Rect sourceCrop,
         bool useIdentityTransform) {
-    return ScreenshotClient::update(display, 0, 0, 0, -1UL,
+    return ScreenshotClient::update(display, sourceCrop, 0, 0, 0, -1UL,
             useIdentityTransform);
 }
 
-status_t ScreenshotClient::update(const sp<IBinder>& display,
+status_t ScreenshotClient::update(const sp<IBinder>& display, Rect sourceCrop,
         uint32_t reqWidth, uint32_t reqHeight, bool useIdentityTransform) {
-    return ScreenshotClient::update(display, reqWidth, reqHeight, 0, -1UL,
-            useIdentityTransform);
+    return ScreenshotClient::update(display, sourceCrop, reqWidth, reqHeight,
+            0, -1UL, useIdentityTransform);
 }
 
 void ScreenshotClient::release() {
diff --git a/libs/gui/tests/Surface_test.cpp b/libs/gui/tests/Surface_test.cpp
index bf87fad..5e6aeef 100644
--- a/libs/gui/tests/Surface_test.cpp
+++ b/libs/gui/tests/Surface_test.cpp
@@ -21,6 +21,7 @@
 #include <gui/Surface.h>
 #include <gui/SurfaceComposerClient.h>
 #include <gui/BufferItemConsumer.h>
+#include <ui/Rect.h>
 #include <utils/String8.h>
 
 #include <private/gui/ComposerService.h>
@@ -94,7 +95,7 @@
     sp<CpuConsumer> cpuConsumer = new CpuConsumer(consumer, 1);
     sp<ISurfaceComposer> sf(ComposerService::getComposerService());
     sp<IBinder> display(sf->getBuiltInDisplay(ISurfaceComposer::eDisplayIdMain));
-    ASSERT_EQ(NO_ERROR, sf->captureScreen(display, producer,
+    ASSERT_EQ(NO_ERROR, sf->captureScreen(display, producer, Rect(),
             64, 64, 0, 0x7fffffff, false));
 
     // Set the PROTECTED usage bit and verify that the screenshot fails.  Note
@@ -123,7 +124,7 @@
                 &buf));
         ASSERT_EQ(NO_ERROR, anw->queueBuffer(anw.get(), buf, -1));
     }
-    ASSERT_EQ(NO_ERROR, sf->captureScreen(display, producer,
+    ASSERT_EQ(NO_ERROR, sf->captureScreen(display, producer, Rect(),
             64, 64, 0, 0x7fffffff, false));
 }
 
diff --git a/libs/input/tests/Android.mk b/libs/input/tests/Android.mk
index c62dff1..9612a65 100644
--- a/libs/input/tests/Android.mk
+++ b/libs/input/tests/Android.mk
@@ -29,5 +29,16 @@
     $(eval include $(BUILD_NATIVE_TEST)) \
 )
 
+# NOTE: This is a compile time test, and does not need to be
+# run. All assertions are static_asserts and will fail during
+# buildtime if something's wrong.
+include $(CLEAR_VARS)
+LOCAL_SRC_FILES := StructLayout_test.cpp
+LOCAL_MODULE := StructLayout_test
+LOCAL_CFLAGS := -std=c++11 -O0
+LOCAL_MULTILIB := both
+include $(BUILD_STATIC_LIBRARY)
+
+
 # Build the manual test programs.
 include $(call all-makefiles-under, $(LOCAL_PATH))
diff --git a/libs/input/tests/StructLayout_test.cpp b/libs/input/tests/StructLayout_test.cpp
new file mode 100644
index 0000000..83bc6ae
--- /dev/null
+++ b/libs/input/tests/StructLayout_test.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <input/InputTransport.h>
+#include <input/Input.h>
+
+namespace android {
+
+#define CHECK_OFFSET(type, member, expected_offset) \
+  static_assert((offsetof(type, member) == expected_offset), "")
+
+struct Foo {
+  uint32_t dummy;
+  PointerCoords coords;
+};
+
+void TestPointerCoordsAlignment() {
+  CHECK_OFFSET(Foo, coords, 8);
+}
+
+void TestInputMessageAlignment() {
+  CHECK_OFFSET(InputMessage, body, 8);
+
+  CHECK_OFFSET(InputMessage::Body::Key, seq, 0);
+  CHECK_OFFSET(InputMessage::Body::Key, eventTime, 8);
+  CHECK_OFFSET(InputMessage::Body::Key, deviceId, 16);
+  CHECK_OFFSET(InputMessage::Body::Key, source, 20);
+  CHECK_OFFSET(InputMessage::Body::Key, action, 24);
+  CHECK_OFFSET(InputMessage::Body::Key, flags, 28);
+  CHECK_OFFSET(InputMessage::Body::Key, keyCode, 32);
+  CHECK_OFFSET(InputMessage::Body::Key, scanCode, 36);
+  CHECK_OFFSET(InputMessage::Body::Key, metaState, 40);
+  CHECK_OFFSET(InputMessage::Body::Key, repeatCount, 44);
+  CHECK_OFFSET(InputMessage::Body::Key, downTime, 48);
+
+  CHECK_OFFSET(InputMessage::Body::Motion, seq, 0);
+  CHECK_OFFSET(InputMessage::Body::Motion, eventTime, 8);
+  CHECK_OFFSET(InputMessage::Body::Motion, deviceId, 16);
+  CHECK_OFFSET(InputMessage::Body::Motion, source, 20);
+  CHECK_OFFSET(InputMessage::Body::Motion, action, 24);
+  CHECK_OFFSET(InputMessage::Body::Motion, flags, 28);
+  CHECK_OFFSET(InputMessage::Body::Motion, metaState, 32);
+  CHECK_OFFSET(InputMessage::Body::Motion, buttonState, 36);
+  CHECK_OFFSET(InputMessage::Body::Motion, edgeFlags, 40);
+  CHECK_OFFSET(InputMessage::Body::Motion, downTime, 48);
+  CHECK_OFFSET(InputMessage::Body::Motion, xOffset, 56);
+  CHECK_OFFSET(InputMessage::Body::Motion, yOffset, 60);
+  CHECK_OFFSET(InputMessage::Body::Motion, xPrecision, 64);
+  CHECK_OFFSET(InputMessage::Body::Motion, yPrecision, 68);
+  CHECK_OFFSET(InputMessage::Body::Motion, pointerCount, 72);
+  CHECK_OFFSET(InputMessage::Body::Motion, pointers, 80);
+}
+
+} // namespace android
diff --git a/opengl/libs/Android.mk b/opengl/libs/Android.mk
index 35feb61..6b90243 100644
--- a/opengl/libs/Android.mk
+++ b/opengl/libs/Android.mk
@@ -47,7 +47,7 @@
 ifeq ($(BOARD_ALLOW_EGL_HIBERNATION),true)
   LOCAL_CFLAGS += -DBOARD_ALLOW_EGL_HIBERNATION
 endif
-ifneq ($(filter omap3 omap4,$(TARGET_BOARD_PLATFORM)),)
+ifeq ($(TARGET_BOARD_PLATFORM), omap4)
   LOCAL_CFLAGS += -DWORKAROUND_BUG_10194508=1
 endif
 ifneq ($(MAX_EGL_CACHE_ENTRY_SIZE),)
diff --git a/opengl/libs/EGL/getProcAddress.cpp b/opengl/libs/EGL/getProcAddress.cpp
index add2a79..fc61134 100644
--- a/opengl/libs/EGL/getProcAddress.cpp
+++ b/opengl/libs/EGL/getProcAddress.cpp
@@ -53,7 +53,71 @@
             : [tls] "J"(TLS_SLOT_OPENGL_API*4),                 \
               [api] "J"(__builtin_offsetof(gl_hooks_t,          \
                                       ext.extensions[_api]))    \
-            :                                                   \
+            : "r12"                                             \
+            );
+
+#elif defined(__aarch64__)
+
+    #define API_ENTRY(_api) __attribute__((noinline)) _api
+
+    #define CALL_GL_EXTENSION_API(_api)                             \
+        asm volatile(                                               \
+            "mrs x16, tpidr_el0\n"                                  \
+            "ldr x16, [x16, %[tls]]\n"                              \
+            "cbz x16, 1f\n"                                         \
+            "ldr x16, [x16, %[api]]\n"                              \
+            "cbz x16, 1f\n"                                         \
+            "br  x16\n"                                             \
+            "1:\n"                                                  \
+            :                                                       \
+            : [tls] "i" (TLS_SLOT_OPENGL_API * sizeof(void*)),      \
+              [api] "i" (__builtin_offsetof(gl_hooks_t,             \
+                                        ext.extensions[_api]))      \
+            : "x16"                                                 \
+        );
+
+#elif defined(__i386__)
+
+    #define API_ENTRY(_api) __attribute__((noinline)) _api
+
+    #define CALL_GL_EXTENSION_API(_api)                         \
+         register void** fn;                                    \
+         __asm__ volatile(                                      \
+            "mov %%gs:0, %[fn]\n"                               \
+            "mov %P[tls](%[fn]), %[fn]\n"                       \
+            "test %[fn], %[fn]\n"                               \
+            "cmovne %P[api](%[fn]), %[fn]\n"                    \
+            "test %[fn], %[fn]\n"                               \
+            "je 1f\n"                                           \
+            "jmp *%[fn]\n"                                      \
+            "1:\n"                                              \
+            : [fn] "=r" (fn)                                    \
+            : [tls] "i" (TLS_SLOT_OPENGL_API*sizeof(void*)),    \
+              [api] "i" (__builtin_offsetof(gl_hooks_t,         \
+                                      ext.extensions[_api]))    \
+            : "cc"                                              \
+            );
+
+#elif defined(__x86_64__)
+
+    #define API_ENTRY(_api) __attribute__((noinline)) _api
+
+    #define CALL_GL_EXTENSION_API(_api)                         \
+         register void** fn;                                    \
+         __asm__ volatile(                                      \
+            "mov %%fs:0, %[fn]\n"                               \
+            "mov %P[tls](%[fn]), %[fn]\n"                       \
+            "test %[fn], %[fn]\n"                               \
+            "cmovne %P[api](%[fn]), %[fn]\n"                    \
+            "test %[fn], %[fn]\n"                               \
+            "je 1f\n"                                           \
+            "jmp *%[fn]\n"                                      \
+            "1:\n"                                              \
+            : [fn] "=r" (fn)                                    \
+            : [tls] "i" (TLS_SLOT_OPENGL_API*sizeof(void*)),    \
+              [api] "i" (__builtin_offsetof(gl_hooks_t,         \
+                                      ext.extensions[_api]))    \
+            : "cc"                                              \
             );
 
 #elif defined(__mips__)
@@ -86,6 +150,7 @@
                                           ext.extensions[_api]))    \
                 :                                                   \
             );
+
 #endif
 
 #if defined(CALL_GL_EXTENSION_API)
diff --git a/opengl/libs/GLES2/gl2.cpp b/opengl/libs/GLES2/gl2.cpp
index 75fc95c..b07228f 100644
--- a/opengl/libs/GLES2/gl2.cpp
+++ b/opengl/libs/GLES2/gl2.cpp
@@ -36,7 +36,15 @@
 #undef CALL_GL_API
 #undef CALL_GL_API_RETURN
 
-#if defined(__arm__) && !USE_SLOW_BINDING
+#if USE_SLOW_BINDING
+
+    #define API_ENTRY(_api) _api
+
+    #define CALL_GL_API(_api, ...)                                       \
+        gl_hooks_t::gl_t const * const _c = &getGlThreadSpecific()->gl;  \
+        if (_c) return _c->_api(__VA_ARGS__);
+
+#elif defined(__arm__)
 
     #define GET_TLS(reg) "mrc p15, 0, " #reg ", c13, c0, 3 \n"
 
@@ -51,10 +59,66 @@
             :                                                   \
             : [tls] "J"(TLS_SLOT_OPENGL_API*4),                 \
               [api] "J"(__builtin_offsetof(gl_hooks_t, gl._api))    \
-            :                                                   \
+            : "r12"                                             \
             );
 
-#elif defined(__mips__) && !USE_SLOW_BINDING
+#elif defined(__aarch64__)
+
+    #define API_ENTRY(_api) __attribute__((noinline)) _api
+
+    #define CALL_GL_API(_api, ...)                                  \
+        asm volatile(                                               \
+            "mrs x16, tpidr_el0\n"                                  \
+            "ldr x16, [x16, %[tls]]\n"                              \
+            "cbz x16, 1f\n"                                         \
+            "ldr x16, [x16, %[api]]\n"                              \
+            "br  x16\n"                                             \
+            "1:\n"                                                  \
+            :                                                       \
+            : [tls] "i" (TLS_SLOT_OPENGL_API * sizeof(void*)),      \
+              [api] "i" (__builtin_offsetof(gl_hooks_t, gl._api))   \
+            : "x16"                                                 \
+        );
+
+#elif defined(__i386__)
+
+    #define API_ENTRY(_api) __attribute__((noinline)) _api
+
+    #define CALL_GL_API(_api, ...)                                  \
+        register void** fn;                                         \
+        __asm__ volatile(                                           \
+            "mov %%gs:0, %[fn]\n"                                   \
+            "mov %P[tls](%[fn]), %[fn]\n"                           \
+            "test %[fn], %[fn]\n"                                   \
+            "je 1f\n"                                               \
+            "jmp *%P[api](%[fn])\n"                                 \
+            "1:\n"                                                  \
+            : [fn] "=r" (fn)                                        \
+            : [tls] "i" (TLS_SLOT_OPENGL_API*sizeof(void*)),        \
+              [api] "i" (__builtin_offsetof(gl_hooks_t, gl._api))   \
+            : "cc"                                                  \
+            );
+
+#elif defined(__x86_64__)
+
+    #define API_ENTRY(_api) __attribute__((noinline)) _api
+
+    #define CALL_GL_API(_api, ...)                                  \
+         register void** fn;                                        \
+         __asm__ volatile(                                          \
+            "mov %%fs:0, %[fn]\n"                                   \
+            "mov %P[tls](%[fn]), %[fn]\n"                           \
+            "test %[fn], %[fn]\n"                                   \
+            "je 1f\n"                                               \
+            "jmp *%P[api](%[fn])\n"                                 \
+            "1:\n"                                                  \
+            : [fn] "=r" (fn)                                        \
+            : [tls] "i" (TLS_SLOT_OPENGL_API*sizeof(void*)),        \
+              [api] "i" (__builtin_offsetof(gl_hooks_t, gl._api))   \
+            : "cc"                                                  \
+            );
+
+#elif defined(__mips__)
 
     #define API_ENTRY(_api) __attribute__((noinline)) _api
 
@@ -86,14 +150,6 @@
             :                                                    \
             );
 
-#else
-
-    #define API_ENTRY(_api) _api
-
-    #define CALL_GL_API(_api, ...)                                       \
-        gl_hooks_t::gl_t const * const _c = &getGlThreadSpecific()->gl;  \
-        if (_c) return _c->_api(__VA_ARGS__);
-
 #endif
 
 #define CALL_GL_API_RETURN(_api, ...) \
diff --git a/opengl/libs/GLES_CM/gl.cpp b/opengl/libs/GLES_CM/gl.cpp
index e5de4a7..f05983c 100644
--- a/opengl/libs/GLES_CM/gl.cpp
+++ b/opengl/libs/GLES_CM/gl.cpp
@@ -92,7 +92,15 @@
 #undef CALL_GL_API
 #undef CALL_GL_API_RETURN
 
-#if defined(__arm__) && !USE_SLOW_BINDING
+#if USE_SLOW_BINDING
+
+    #define API_ENTRY(_api) _api
+
+    #define CALL_GL_API(_api, ...)                                       \
+        gl_hooks_t::gl_t const * const _c = &getGlThreadSpecific()->gl;  \
+        if (_c) return _c->_api(__VA_ARGS__);
+
+#elif defined(__arm__)
 
     #define GET_TLS(reg) "mrc p15, 0, " #reg ", c13, c0, 3 \n"
 
@@ -107,10 +115,66 @@
             :                                                   \
             : [tls] "J"(TLS_SLOT_OPENGL_API*4),                 \
               [api] "J"(__builtin_offsetof(gl_hooks_t, gl._api))    \
-            :                                                   \
+            : "r12"                                             \
             );
 
-#elif defined(__mips__) && !USE_SLOW_BINDING
+#elif defined(__aarch64__)
+
+    #define API_ENTRY(_api) __attribute__((noinline)) _api
+
+    #define CALL_GL_API(_api, ...)                                  \
+        asm volatile(                                               \
+            "mrs x16, tpidr_el0\n"                                  \
+            "ldr x16, [x16, %[tls]]\n"                              \
+            "cbz x16, 1f\n"                                         \
+            "ldr x16, [x16, %[api]]\n"                              \
+            "br  x16\n"                                             \
+            "1:\n"                                                  \
+            :                                                       \
+            : [tls] "i" (TLS_SLOT_OPENGL_API * sizeof(void*)),      \
+              [api] "i" (__builtin_offsetof(gl_hooks_t, gl._api))   \
+            : "x16"                                                 \
+        );
+
+#elif defined(__i386__)
+
+    #define API_ENTRY(_api) __attribute__((noinline)) _api
+
+    #define CALL_GL_API(_api, ...)                                  \
+        register void* fn;                                          \
+        __asm__ volatile(                                           \
+            "mov %%gs:0, %[fn]\n"                                   \
+            "mov %P[tls](%[fn]), %[fn]\n"                           \
+            "test %[fn], %[fn]\n"                                   \
+            "je 1f\n"                                               \
+            "jmp *%P[api](%[fn])\n"                                 \
+            "1:\n"                                                  \
+            : [fn] "=r" (fn)                                        \
+            : [tls] "i" (TLS_SLOT_OPENGL_API*sizeof(void*)),        \
+              [api] "i" (__builtin_offsetof(gl_hooks_t, gl._api))   \
+            : "cc"                                                  \
+            );
+
+#elif defined(__x86_64__)
+
+    #define API_ENTRY(_api) __attribute__((noinline)) _api
+
+    #define CALL_GL_API(_api, ...)                                  \
+         register void** fn;                                        \
+         __asm__ volatile(                                          \
+            "mov %%fs:0, %[fn]\n"                                   \
+            "mov %P[tls](%[fn]), %[fn]\n"                           \
+            "test %[fn], %[fn]\n"                                   \
+            "je 1f\n"                                               \
+            "jmp *%P[api](%[fn])\n"                                 \
+            "1:\n"                                                  \
+            : [fn] "=r" (fn)                                        \
+            : [tls] "i" (TLS_SLOT_OPENGL_API*sizeof(void*)),        \
+              [api] "i" (__builtin_offsetof(gl_hooks_t, gl._api))   \
+            : "cc"                                                  \
+            );
+
+#elif defined(__mips__)
 
     #define API_ENTRY(_api) __attribute__((noinline)) _api
 
@@ -142,14 +206,6 @@
             :                                                    \
             );
 
-#else
-
-    #define API_ENTRY(_api) _api
-
-    #define CALL_GL_API(_api, ...)                                       \
-        gl_hooks_t::gl_t const * const _c = &getGlThreadSpecific()->gl;  \
-        if (_c) return _c->_api(__VA_ARGS__);
-
 #endif
 
 #define CALL_GL_API_RETURN(_api, ...) \
diff --git a/services/sensorservice/SensorInterface.cpp b/services/sensorservice/SensorInterface.cpp
index 2bf5e72..970220b 100644
--- a/services/sensorservice/SensorInterface.cpp
+++ b/services/sensorservice/SensorInterface.cpp
@@ -17,8 +17,6 @@
 #include <stdint.h>
 #include <sys/types.h>
 
-#include <cutils/log.h>
-
 #include "SensorInterface.h"
 
 namespace android {
@@ -34,7 +32,6 @@
     : mSensorDevice(SensorDevice::getInstance()),
       mSensor(&sensor, mSensorDevice.getHalDeviceVersion())
 {
-    ALOGI("%s", sensor.name);
 }
 
 HardwareSensor::~HardwareSensor() {
diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp
index aff4e9a..1bee04f 100644
--- a/services/sensorservice/SensorService.cpp
+++ b/services/sensorservice/SensorService.cpp
@@ -159,7 +159,6 @@
                     mSocketBufferSize = MAX_SOCKET_BUFFER_SIZE_BATCHED;
                 }
             }
-            ALOGD("Max socket buffer size %u", mSocketBufferSize);
             if (fp) {
                 fclose(fp);
             }
diff --git a/services/surfaceflinger/DisplayDevice.cpp b/services/surfaceflinger/DisplayDevice.cpp
index 42993b9..4ebe291 100644
--- a/services/surfaceflinger/DisplayDevice.cpp
+++ b/services/surfaceflinger/DisplayDevice.cpp
@@ -283,7 +283,8 @@
 void DisplayDevice::setViewportAndProjection() const {
     size_t w = mDisplayWidth;
     size_t h = mDisplayHeight;
-    mFlinger->getRenderEngine().setViewportAndProjection(w, h, w, h, false);
+    Rect sourceCrop(0, 0, w, h);
+    mFlinger->getRenderEngine().setViewportAndProjection(w, h, sourceCrop, h, false);
 }
 
 // ----------------------------------------------------------------------------
diff --git a/services/surfaceflinger/RenderEngine/GLES11RenderEngine.cpp b/services/surfaceflinger/RenderEngine/GLES11RenderEngine.cpp
index cbff320..d1e324c 100644
--- a/services/surfaceflinger/RenderEngine/GLES11RenderEngine.cpp
+++ b/services/surfaceflinger/RenderEngine/GLES11RenderEngine.cpp
@@ -17,6 +17,8 @@
 #include <GLES/gl.h>
 #include <GLES/glext.h>
 
+#include <ui/Rect.h>
+
 #include <utils/String8.h>
 #include <cutils/compiler.h>
 
@@ -72,13 +74,23 @@
 }
 
 void GLES11RenderEngine::setViewportAndProjection(
-        size_t vpw, size_t vph, size_t w, size_t h, bool yswap) {
+        size_t vpw, size_t vph, Rect sourceCrop, size_t hwh, bool yswap) {
     glViewport(0, 0, vpw, vph);
     glMatrixMode(GL_PROJECTION);
     glLoadIdentity();
-    // put the origin in the left-bottom corner
-    if (yswap)  glOrthof(0, w, h, 0, 0, 1);
-    else        glOrthof(0, w, 0, h, 0, 1);
+
+    size_t l = sourceCrop.left;
+    size_t r = sourceCrop.right;
+
+    // In GL, (0, 0) is the bottom-left corner, so flip y coordinates
+    size_t t = hwh - sourceCrop.top;
+    size_t b = hwh - sourceCrop.bottom;
+
+    if (yswap) {
+        glOrthof(l, r, t, b, 0, 1);
+    } else {
+        glOrthof(l, r, b, t, 0, 1);
+    }
     glMatrixMode(GL_MODELVIEW);
 }
 
diff --git a/services/surfaceflinger/RenderEngine/GLES11RenderEngine.h b/services/surfaceflinger/RenderEngine/GLES11RenderEngine.h
index cd53aab..1a94592 100644
--- a/services/surfaceflinger/RenderEngine/GLES11RenderEngine.h
+++ b/services/surfaceflinger/RenderEngine/GLES11RenderEngine.h
@@ -49,7 +49,8 @@
     virtual ~GLES11RenderEngine();
 
     virtual void dump(String8& result);
-    virtual void setViewportAndProjection(size_t vpw, size_t vph, size_t w, size_t h, bool yswap);
+    virtual void setViewportAndProjection(size_t vpw, size_t vph,
+            Rect sourceCrop, size_t hwh, bool yswap);
     virtual void setupLayerBlending(bool premultipliedAlpha, bool opaque, int alpha);
     virtual void setupDimLayerBlending(int alpha);
     virtual void setupLayerTexturing(const Texture& texture);
diff --git a/services/surfaceflinger/RenderEngine/GLES20RenderEngine.cpp b/services/surfaceflinger/RenderEngine/GLES20RenderEngine.cpp
index a2a6270..8c1f04e 100644
--- a/services/surfaceflinger/RenderEngine/GLES20RenderEngine.cpp
+++ b/services/surfaceflinger/RenderEngine/GLES20RenderEngine.cpp
@@ -19,6 +19,8 @@
 #include <GLES2/gl2.h>
 #include <GLES2/gl2ext.h>
 
+#include <ui/Rect.h>
+
 #include <utils/String8.h>
 #include <utils/Trace.h>
 
@@ -78,10 +80,21 @@
 }
 
 void GLES20RenderEngine::setViewportAndProjection(
-        size_t vpw, size_t vph, size_t w, size_t h, bool yswap) {
+        size_t vpw, size_t vph, Rect sourceCrop, size_t hwh, bool yswap) {
+
+    size_t l = sourceCrop.left;
+    size_t r = sourceCrop.right;
+
+    // In GL, (0, 0) is the bottom-left corner, so flip y coordinates
+    size_t t = hwh - sourceCrop.top;
+    size_t b = hwh - sourceCrop.bottom;
+
     mat4 m;
-    if (yswap)  m = mat4::ortho(0, w, h, 0, 0, 1);
-    else        m = mat4::ortho(0, w, 0, h, 0, 1);
+    if (yswap) {
+        m = mat4::ortho(l, r, t, b, 0, 1);
+    } else {
+        m = mat4::ortho(l, r, b, t, 0, 1);
+    }
 
     glViewport(0, 0, vpw, vph);
     mState.setProjectionMatrix(m);
diff --git a/services/surfaceflinger/RenderEngine/GLES20RenderEngine.h b/services/surfaceflinger/RenderEngine/GLES20RenderEngine.h
index 8b67fcc..b6d32fc 100644
--- a/services/surfaceflinger/RenderEngine/GLES20RenderEngine.h
+++ b/services/surfaceflinger/RenderEngine/GLES20RenderEngine.h
@@ -64,7 +64,8 @@
     virtual ~GLES20RenderEngine();
 
     virtual void dump(String8& result);
-    virtual void setViewportAndProjection(size_t vpw, size_t vph, size_t w, size_t h, bool yswap);
+    virtual void setViewportAndProjection(size_t vpw, size_t vph,
+            Rect sourceCrop, size_t hwh, bool yswap);
     virtual void setupLayerBlending(bool premultipliedAlpha, bool opaque, int alpha);
     virtual void setupDimLayerBlending(int alpha);
     virtual void setupLayerTexturing(const Texture& texture);
diff --git a/services/surfaceflinger/RenderEngine/RenderEngine.h b/services/surfaceflinger/RenderEngine/RenderEngine.h
index 577dc0a..a2d8242 100644
--- a/services/surfaceflinger/RenderEngine/RenderEngine.h
+++ b/services/surfaceflinger/RenderEngine/RenderEngine.h
@@ -89,7 +89,8 @@
 
     // set-up
     virtual void checkErrors() const;
-    virtual void setViewportAndProjection(size_t vpw, size_t vph, size_t w, size_t h, bool yswap) = 0;
+    virtual void setViewportAndProjection(size_t vpw, size_t vph,
+            Rect sourceCrop, size_t hwh, bool yswap) = 0;
     virtual void setupLayerBlending(bool premultipliedAlpha, bool opaque, int alpha) = 0;
     virtual void setupDimLayerBlending(int alpha) = 0;
     virtual void setupLayerTexturing(const Texture& texture) = 0;
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 59afa66..7152f93 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -2790,7 +2790,7 @@
 
 status_t SurfaceFlinger::captureScreen(const sp<IBinder>& display,
         const sp<IGraphicBufferProducer>& producer,
-        uint32_t reqWidth, uint32_t reqHeight,
+        Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
         uint32_t minLayerZ, uint32_t maxLayerZ,
         bool useIdentityTransform) {
 
@@ -2816,6 +2816,7 @@
         SurfaceFlinger* flinger;
         sp<IBinder> display;
         sp<IGraphicBufferProducer> producer;
+        Rect sourceCrop;
         uint32_t reqWidth, reqHeight;
         uint32_t minLayerZ,maxLayerZ;
         bool useIdentityTransform;
@@ -2824,11 +2825,11 @@
         MessageCaptureScreen(SurfaceFlinger* flinger,
                 const sp<IBinder>& display,
                 const sp<IGraphicBufferProducer>& producer,
-                uint32_t reqWidth, uint32_t reqHeight,
+                Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
                 uint32_t minLayerZ, uint32_t maxLayerZ,
                 bool useIdentityTransform)
             : flinger(flinger), display(display), producer(producer),
-              reqWidth(reqWidth), reqHeight(reqHeight),
+              sourceCrop(sourceCrop), reqWidth(reqWidth), reqHeight(reqHeight),
               minLayerZ(minLayerZ), maxLayerZ(maxLayerZ),
               useIdentityTransform(useIdentityTransform),
               result(PERMISSION_DENIED)
@@ -2841,7 +2842,7 @@
             Mutex::Autolock _l(flinger->mStateLock);
             sp<const DisplayDevice> hw(flinger->getDisplayDevice(display));
             result = flinger->captureScreenImplLocked(hw, producer,
-                    reqWidth, reqHeight, minLayerZ, maxLayerZ,
+                    sourceCrop, reqWidth, reqHeight, minLayerZ, maxLayerZ,
                     useIdentityTransform);
             static_cast<GraphicProducerWrapper*>(producer->asBinder().get())->exit(result);
             return true;
@@ -2864,7 +2865,8 @@
     // which does the marshaling work forwards to our "fake remote" above.
     sp<MessageBase> msg = new MessageCaptureScreen(this,
             display, IGraphicBufferProducer::asInterface( wrapper ),
-            reqWidth, reqHeight, minLayerZ, maxLayerZ, useIdentityTransform);
+            sourceCrop, reqWidth, reqHeight, minLayerZ, maxLayerZ,
+            useIdentityTransform);
 
     status_t res = postMessageAsync(msg);
     if (res == NO_ERROR) {
@@ -2876,7 +2878,7 @@
 
 void SurfaceFlinger::renderScreenImplLocked(
         const sp<const DisplayDevice>& hw,
-        uint32_t reqWidth, uint32_t reqHeight,
+        Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
         uint32_t minLayerZ, uint32_t maxLayerZ,
         bool yswap, bool useIdentityTransform)
 {
@@ -2888,11 +2890,32 @@
     const uint32_t hw_h = hw->getHeight();
     const bool filtering = reqWidth != hw_w || reqWidth != hw_h;
 
+    // if a default or invalid sourceCrop is passed in, set reasonable values
+    if (sourceCrop.width() == 0 || sourceCrop.height() == 0 ||
+            !sourceCrop.isValid()) {
+        sourceCrop.setLeftTop(Point(0, 0));
+        sourceCrop.setRightBottom(Point(hw_w, hw_h));
+    }
+
+    // ensure that sourceCrop is inside screen
+    if (sourceCrop.left < 0) {
+        ALOGE("Invalid crop rect: l = %d (< 0)", sourceCrop.left);
+    }
+    if (sourceCrop.right >= hw_w) {
+        ALOGE("Invalid crop rect: r = %d (>= %d)", sourceCrop.right, hw_w);
+    }
+    if (sourceCrop.top < 0) {
+        ALOGE("Invalid crop rect: t = %d (< 0)", sourceCrop.top);
+    }
+    if (sourceCrop.bottom >= hw_h) {
+        ALOGE("Invalid crop rect: b = %d (>= %d)", sourceCrop.bottom, hw_h);
+    }
+
     // make sure to clear all GL error flags
     engine.checkErrors();
 
     // set-up our viewport
-    engine.setViewportAndProjection(reqWidth, reqHeight, hw_w, hw_h, yswap);
+    engine.setViewportAndProjection(reqWidth, reqHeight, sourceCrop, hw_h, yswap);
     engine.disableTexturing();
 
     // redraw the screen entirely...
@@ -2923,7 +2946,7 @@
 status_t SurfaceFlinger::captureScreenImplLocked(
         const sp<const DisplayDevice>& hw,
         const sp<IGraphicBufferProducer>& producer,
-        uint32_t reqWidth, uint32_t reqHeight,
+        Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
         uint32_t minLayerZ, uint32_t maxLayerZ,
         bool useIdentityTransform)
 {
@@ -2978,7 +3001,7 @@
                         // via an FBO, which means we didn't have to create
                         // an EGLSurface and therefore we're not
                         // dependent on the context's EGLConfig.
-                        renderScreenImplLocked(hw, reqWidth, reqHeight,
+                        renderScreenImplLocked(hw, sourceCrop, reqWidth, reqHeight,
                                 minLayerZ, maxLayerZ, true, useIdentityTransform);
 
                         // Create a sync point and wait on it, so we know the buffer is
diff --git a/services/surfaceflinger/SurfaceFlinger.h b/services/surfaceflinger/SurfaceFlinger.h
index 0b868e2..cc01eb3 100644
--- a/services/surfaceflinger/SurfaceFlinger.h
+++ b/services/surfaceflinger/SurfaceFlinger.h
@@ -202,7 +202,7 @@
     virtual sp<IDisplayEventConnection> createDisplayEventConnection();
     virtual status_t captureScreen(const sp<IBinder>& display,
             const sp<IGraphicBufferProducer>& producer,
-            uint32_t reqWidth, uint32_t reqHeight,
+            Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
             uint32_t minLayerZ, uint32_t maxLayerZ,
             bool useIdentityTransform);
     // called when screen needs to turn off
@@ -311,14 +311,14 @@
 
     void renderScreenImplLocked(
             const sp<const DisplayDevice>& hw,
-            uint32_t reqWidth, uint32_t reqHeight,
+            Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
             uint32_t minLayerZ, uint32_t maxLayerZ,
             bool yswap, bool useIdentityTransform);
 
     status_t captureScreenImplLocked(
             const sp<const DisplayDevice>& hw,
             const sp<IGraphicBufferProducer>& producer,
-            uint32_t reqWidth, uint32_t reqHeight,
+            Rect sourceCrop, uint32_t reqWidth, uint32_t reqHeight,
             uint32_t minLayerZ, uint32_t maxLayerZ,
             bool useIdentityTransform);